Canadian Privacy Decisions

This investigation concerned an individual's complaint that their Permanent Resident Card renewal application, submitted to Immigration, Refugees and Citizenship Canada (IRCC), was inappropriately disclosed to the Canada Border Services Agency (CBSA). The complainant alleged this disclosure was contrary to the purpose for which the information was collected and that it was used in support of a cessation application to terminate refugee protection. The OPC found that the disclosure was consistent with the purpose for which the information was obtained, as both departments share a mandate under the Immigration and Refugee Protection Act and information sharing for immigration legislation enforcement is considered a consistent use. Therefore, the complaints against both departments were found not well-founded.

• Whether IRCC was authorized to disclose the complainant's personal information to the CBSA.
• Whether the disclosure was for a purpose for which the information was obtained or a consistent use.
• The interpretation of "consistent use" under paragraph 8(2)(a) of the Privacy Act.
• The impact of the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB).

The complainant alleged that Library and Archives Canada (LAC) took an unreasonable amount of time to grant a time extension for an access to information request. The request was for records related to access requests concerning 'Project Anecdote'. LAC claimed a 1,095-day extension under paragraphs 9(1)(a) and (b) of the Act, pushing the response deadline to June 20, 2025. The Information Commissioner found that LAC met all the requirements for this extension, deeming it valid.

• Reasonableness of time extension claimed by institution under subsection 9(1)
• Whether institution met the requirements of paragraphs 9(1)(a) and (b) for the extension

The complainant alleged that the Department of Justice Canada did not conduct a reasonable search for a 2009 workplace report. The Department stated that the record's retention period was five years and it was requested seven years later, meaning it would have been destroyed. While the complainant claimed the consultant still had a copy, the Department argued it was not reasonable to contact the consultant directly given the nature and age of the contract. The OIC agreed that the Department conducted a reasonable search.

• Did the institution conduct a reasonable search for the requested records?
• Whether the institution was required to contact the consultant directly to fulfill the request.

This investigation examined whether COVID-19 vaccination attestation requirements implemented by several federal separate employers for their employees complied with the Privacy Act. The OPC found that the collection and use of vaccination status information, including for accommodation requests, was authorized under the Act and directly related to the employers' operating programs, specifically workplace health and safety during the pandemic. While not a strict legal requirement of the Act, the OPC also assessed the necessity and proportionality of these measures and found them to be reasonable given the exceptional circumstances of the pandemic.

• Whether the collection of COVID-19 vaccination status information was directly related to an operating program or activity of the institutions.
• Whether the use and disclosure of vaccination status information, including for accommodation requests, was authorized under the Privacy Act.
• The necessity and proportionality of the vaccination attestation measures in the context of the COVID-19 pandemic.

This investigation examined whether mobility data collected by the Public Health Agency of Canada (PHAC) during the COVID-19 pandemic contained personal information as defined under the Privacy Act. The investigation found that the de-identification techniques and safeguards against re-identification implemented by PHAC and its data providers reduced the risk of identifying individuals below the "serious possibility" threshold. Consequently, the complaints were deemed not well-founded, as PHAC did not contravene the Privacy Act.

• Whether the mobility data collected constituted personal information under the Privacy Act.
• The adequacy of de-identification and aggregation techniques to prevent re-identification.
• Whether access to data within a provider's system constitutes collection under the Act.
• The need for transparency regarding the use of de-identified data.

This investigation examined whether the collection, use, retention, and disclosure of personal information by the Public Health Agency of Canada (PHAC) and the Canada Border Services Agency (CBSA) related to COVID-19 vaccine mandates for travellers entering Canada complied with the Privacy Act. The OPC found that the agencies had the authority to collect this information as it was directly related to their mandate under the Quarantine Act and the Emergency Orders. While the OPC identified some weaknesses in PHAC's documentation regarding the necessity and proportionality of the measures, overall, the collection, use, and disclosure of personal information were deemed compliant with the Act.

• Whether personal information collected was directly related to an operating program or activity of PHAC and CBSA.
• Whether personal information was used or disclosed for the purpose for which it was compiled or in accordance with an Act of Parliament.
• Whether personal information was disposed of in accordance with the Privacy Regulations and the Directive on Privacy Practices.
• Whether the collection of personal information under the Emergency Orders was necessary and proportional.

This investigation examined whether the collection, use, and disclosure of traveller vaccination status by Transport Canada, VIA Rail, and CATSA complied with the Privacy Act. The Office of the Privacy Commissioner found that the personal information was collected, used, and disclosed in compliance with the Act's requirements. While the Act does not mandate necessity and proportionality, the OPC also considered these principles and found the measures were generally necessary and proportional, though recommended clearer definition of objectives and documentation of less privacy-invasive alternatives for future initiatives.

• Whether the collection of vaccination information was directly related to the operating programs or activities of CATSA and VIA Rail.
• Whether the use and disclosure of personal information, and the centralized collection by Transport Canada, complied with sections 4, 7, and 8 of the Privacy Act.
• Whether the collection of personal information was necessary and proportional, considering the circumstances and available alternatives.

This investigation examined the COVID-19 vaccination attestation requirements established by the Department of National Defence (DND) for members of the Canadian Armed Forces (CAF). The Office of the Privacy Commissioner of Canada (OPC) found that DND/CAF had the authority to collect this information under the National Defence Act and Part II of the Canada Labour Code. The use and disclosure of the information were generally consistent with the purposes for which it was collected. Although DND declined to implement a recommendation to strengthen oversight of access controls in the Monitor MASS system, the OPC found no instances of inappropriate access or disclosure. The OPC also determined that DND took reasonable steps to ensure the accuracy of the vaccination status information collected.

• Whether DND/CAF's collection of COVID-19 vaccination status information directly related to an operating program or activity of the institution.
• Whether the use of collected vaccination status information was authorized under section 7 of the Privacy Act.
• Whether the use of the Monitor MASS system resulted in unauthorized disclosure of information.
• Whether DND/CAF took reasonable steps to ensure the accuracy of vaccination status information.

The complainant alleged that the Royal Canadian Mounted Police (RCMP) did not conduct a reasonable search for records detailing annual amounts paid due to sexual harassment or assault from 2009 to 2020. The RCMP explained that its general ledger does not record the nature of settlement claims, and they do not maintain a separate list of such payments. Therefore, the RCMP could only identify and disclose information related to publicly known class action settlements. The Information Commissioner was satisfied that the RCMP conducted a reasonable search given these limitations.

• Whether the RCMP conducted a reasonable search for records.
• The ability of the RCMP to search its general ledger for specific types of claims.
• The existence of alternative methods for the RCMP to identify and locate responsive records.

The complainant alleged that Health Canada improperly withheld information from a non-clinical overview of the Novavax COVID-19 vaccine, citing exemptions for confidential third-party financial, commercial, scientific or technical information (paragraph 20(1)(b)). The Information Commissioner of Canada (OIC) found that the information met the criteria for exemption under paragraph 20(1)(b) at the time the request was processed. The OIC also concluded that the conditions under which Health Canada would be required to exercise discretion to release the information (subsections 20(5) and 20(6)) were not met. Therefore, the complaint was found not to be well founded.

• Whether the withheld information qualifies as confidential third-party financial, commercial, scientific or technical information under paragraph 20(1)(b) of the Access to Information Act.
• Whether the conditions for exercising discretion to release information under subsections 20(5) and 20(6) of the Access to Information Act were met.

The complainant alleged that Environment and Climate Change Canada (ECCC) improperly excluded weather radar data, claiming it was available for purchase. ECCC demonstrated that both real-time and archived weather data are offered through a cost-recovery system. As the information was available for purchase, it was excluded from the application of the Access to Information Act.

• Whether the exclusion of material available for purchase under paragraph 68(a) of the ATIA was properly applied.
• Whether real-time data, which must be created after the request is made, falls under the scope of the ATIA.
• Whether the cost-recovery system for accessing weather data renders the information 'available for purchase' under section 68(a).

The complainant alleged that the Canadian Broadcasting Corporation (CBC) improperly withheld information regarding the total remuneration of its highest-paid unionized employees. The CBC claimed exemptions under paragraph 18(b) (competitive position) for specific salary figures. The Information Commissioner found that disclosing these exact salaries could indeed harm the CBC's competitive position in a limited market, and that the CBC reasonably exercised its discretion in withholding the information. Therefore, the complaint was found not well founded.

• Proper application of paragraph 18(b) of the Access to Information Act
• Reasonable expectation of harm to the institution's competitive position
• Reasonable exercise of discretion by the institution to withhold information

The complainant requested the Canada Emergency Wage Subsidy (CEWS) database for all recipient corporations from the Canada Revenue Agency (CRA). The CRA withheld the total amount of CEWS received by each company, citing exemptions under the Access to Information Act (ATIA), including subsection 24(1) (disclosure restricted by another law). The OIC found that the withheld information was about identifiable taxpayers and was prepared for the purposes of administering the Income Tax Act, and therefore properly withheld under subsection 24(1). Consequently, the complaint was found not well founded.

• Whether the CEWS database information was properly withheld under subsection 24(1) of the ATIA, citing section 241 of the Income Tax Act.
• Whether the information was properly withheld under paragraph 16(1)(c) (conduct of investigations) and subsection 19(1) (personal information) of the ATIA.

The complainant alleged that the Public Health Agency of Canada (PHAC) unreasonably extended the time to respond to an access request for correspondence sent and received by its president during a specific week. PHAC cited a large volume of records (estimated at 30,000 pages) and the need for consultations as justification for the extensive extension. The Information Commissioner found that PHAC provided sufficient justification for the time extension under paragraphs 9(1)(a) and 9(1)(b) of the Access to Information Act, making the complaint not well-founded.

• Reasonableness of time extension due to volume of records (ATIA s. 9(1)(a))
• Reasonableness of time extension due to consultations (ATIA s. 9(1)(b))
• Impact of request scope on institution's operations
• Complainant's willingness to narrow the scope of the request

The complainant alleged that the Treasury Board of Canada Secretariat (TBS), in its role as administrator of the federal access to information system, failed to provide adequate support to government institutions during the COVID-19 pandemic. This, the complainant argued, impeded the right of access to government information. The investigation found that TBS engaged in reminding institutions of their obligations, clarified responsibilities, and addressed misinterpretations. Given TBS's limited authority over institutions' day-to-day operations, the Commissioner concluded that the support provided was adequate, and the complaint was not well-founded.

• Adequacy of TBS support to government institutions during the COVID-19 pandemic.
• Impact of TBS support on the right of access to government information.
• Whether TBS's actions were contrary to the principles of openness and transparency.